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AMENDMENTS TO THE CLAIMS 

What Is Claimed Is: 
1-41. Cancelled 

42. (Currently Amended) A computer-based method for identifying a situation representing 
risk to a brokerage or its investors, comprising: 

receiving , on a periodic basis, data from at least one source , wherein the received data 
comprises representative of : 

a plurality of transactions relating to securities tradings and 
a plurality of entities involved in securities trading, 
wherein the plurality of transactions and the plurality of entities are not 
predetermined to be related; 

accessing a scenario library to identify a detection algorithm for identifying a behavior of 
interest comprising one or more sequence detection requirements that is indicative of a risk to a 
brokerage or its investors; 

applying the detection algorithm to identify common e l e ments b e tw ee n on e or more of 
th e plurality of tho transactions and one or more of the plurality of the entities in the received 
data to d e t e rmin e wh e th e r the common elements are coll e ctiv e ly indicativ e of the behavior of 
interest; 

determining whether one or more groups of the transactions and entities collectively 
satisfy at least one of the one or more of the sequence detection requirements ; 

determining, by a computing device, whether on e or more relationships exist among the 
transactions and the e ntities that e xhibit th e common element; and 
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in response to one or more relationships existing among the transactions nnd the entities 
that exhibit the common clement groups of the transactions and entities collectively satisfying at 
least one of the one or more sequence detection requirements , generating an alert informing a 
user of the related transactions and entities that exhibit the common elements one or more groups 
of the transactions and entities . 

43. (Currently Amended) The method of claim 42, wherein the determining whether one or 
more relationships exist groups of the transactions and entities collectively satisfy at least one of 
the one or more sequence detection requirements comprises performing one or more of the 
following on the plurality of transactions and the plurality of entities: 

sequence matching to identify sequences in one or more transactions and to relate the 
identified sequences to one or more of the entities in the received data; 

link analysis to establish connections between one or more transactions and entities in the 
received data; 

rule-based analysis to identi fy at least one of the transactions and entities based on rules 
specifying parameters and thresholds; 

outlier detection analysis to identify at least one of the transactions and entities outside of 
a defined statistical range; 

decision tree analysis; and 

detection processing using neural networks. 

44. (Withdrawn) The method of claim 42, wherein 
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one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises holding concentrated positions in a single security; and 
the received data comprises market value of a concentrated position and total cash and 
security value. 

45. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises holding a concentrated position in low-priced 
securities; and 

the received data comprises low-priced equities balance and total cash and security value. 

46. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises abusing auto-execution systems; and 

the received data comprises information associated with a plurality of orders. 

47. (Withdrawn) The method of claim 46, further comprising generating an alert if one or 
more of the following conditions are met: 

each order is on a same side of a market; 

a total time span between orders is less than a threshold; 
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a quantity of each order is less than an auto-execution threshold; 
a total quantity of orders exceeds the auto-execution threshold; 
a plurality of the orders originate from a same account; 

a plurality of the orders originate from a plurality of accounts associated with a same 
household; and 

the orders are entered during regular trading hours. 

48. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises marking the close; and 

the received data comprises order time, holdings by others in a household and margin 
maintenance percentage. 

49. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises making improper short sales; and 
the received data comprises securities sold by an account holder, securities held long by 
an account holder and securities purchased by an account holder. 

50. (Withdrawn) The method of claim 42, wherein 
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one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behav ior of interest comprises making cross-trades away from the market; and 
the received data comprises information associated with a plurality of executions. 

5 1 . (Withdrawn) The method of claim 50, further comprising generating an alert if a 
plurality of executions: 

occur during extended trading hours: 
involve a same security; 
have a same execution price; 
have a same execution date and time; 
are on opposite sides of a market. 

52. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises encouraging orders by marking them as unsolicited; 

and 

the received data comprises a number of unsolicited orders and a number of solicited 

orders. 

53. (Withdrawn) The method of claim 42, wherein 
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one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises encouraging short-term holding; and 

the received data comprises buy orders, sell orders and indication of solicitation. 

54. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more securities 
representatives; 

the behavior of interest comprises soliciting orders but marking them as unsolicited; and 
the received data comprises solicitation attempts and unsolicited orders. 

55. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more securities 
representatives; 

the behavior of interest comprises shadowing a customer's account; and 
the received data comprises time between trades in a security. 

56. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage order-takers or 
employees; 

the behavior of interest comprises front-running; and 

the received data comprises employee account activity and employee-linked account 
activity. 



-7- 



Attorney Docket No. 124256.00401 

57. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage employees; 
the behavior of interest comprises trading on insider information; and 
the received data comprises closing prices and trades in an account associated with an 
employee. 

58. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage employees; 
the behavior of interest comprises making large deposits; and 

the received data comprises employee deposit amounts and employee account net worth. 

59. (Previously Presented) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage and securities representatives; 

the behavior of interest comprises rapid switching of one mutual fund for another mutual 
fund; and 

the received data comprises fund purchase date, mutual fund sale date and solicitation 
records. 

60. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions invol ve one or more investment advisors; 
the behavior of interest comprises disproportionate allocation of IPO shares; and 
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the received data comprises IPO initial trading price, IPO closing price and subaccount 
IPO allocation. 

6 1 . (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve an investment advisors; 

the behavior of interest comprises unfair allocation of block trades to subaccounts of the 
investment advisor; and 

the received data comprises block trade purchase price, block trade allocation and 
security price at time of allocation. 

62. ( Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve an investment advisor; 

the behavior of interest comprises maintenance of concentrated positions in a subaccount 
of the investment advisor; and 

the received data comprises a value of individual equities within the subaccount, a value 
of the subaccount and a total number of subaccounts managed by the advisor. 

63. (Currently Amended) The method of claim 42, further comprising: 
prioritizing the one or more relationships, wherein tho prioritizing is based on user 

d e fined logic and valu e s 

assigning a priority to each group of the transactions and entities that collectively satisfy 
at least one of the one or more sequence detection requirements : and 
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generating one or more alerts based on one or more of the pr i oritized relationships 
assigned priorities . 

64. (Currently Amended) The method of claim 42, wherein 

determining whether one or more relationships exist determining whether one or more 
groups of the transactions and entities collectively satisfy at least one of the one or more 
sequence detection requirements comprises prioritizing the determined relationships groups of 
transactions and entities that collectively satisfy at least one of the one or more sequence 
detection requirements : and 

generating an alert comprises generation generating an alert only if a relationship group 
having a predetermined priority is identified. 

65. (Currently Amended) The method of claim 42, further comprising; 

identifying any accounts associated with the determined transactions and entities that 
meet a set of user-defined criteria; and 

generating an alert informing the user of the identified accounts. 

66. (Currently Amended) The method of claim 42, further comprising: 

identifying one or more accounts that meet a set of user-defined criteria for a current 
month but that did not meet the set of user-defined criteria for a previous month, wherein the 
accounts are associated with the determined transactions and entities; 

generating an alert comprising the identified accounts. 
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67. (Currently Amended) The method of claim 42, further comprising: 
identifying a household, having a plurality of associated accounts, 
wherein the household meets a set of user-defined criteria, 

wherein the household is associated with one or more of the determined transactions and 
entities; 

wherein none of the associated accounts individually meet the set of user-defined criteria; 

and 

generating an alert comprising the identified household. 

68. (Currently Amended) The method of claim 42, further comprising: 

identifying a first set of households, wherein each household is associated with one or 
more accounts, wherein each household meets a set of user-defined criteria, wherein none of the 
accounts associated with the household individually meet the set of user-defined criteria, wherein 
each household in the first set is associated with one or more of the determined transactions and 
entities; and 

identifying from the first set of households, a second set of households comprising 
households that did not meet the set of user-defined criteria in a previous month. 

69. (Currently Amended) The method of claim 42, wherein generating an alert 
comprises: 

providing one or more alert visualizations associated with the transactions and the entities 
that exhibit the common elements collectively satisfy at least one of the one or more seauence 
detection requirements to a user. 
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70. (Currently Amended) The method of claim 42, further comprising: 

assigning a score to the d e t e rmin e d r e lationships one or more uroups of the transactions 
and entities that collectively satisfy at least one of the one or more sequence detection 
requirements ; 

determining an alert value associated with the alert based on the assigned score; and 
in response to the alert value being below a threshold value, automatically closing the 

alert. 

71 . (Currently Amended) A computer program embodied on a computer readable medium 
for identifying a situation representing risk to a brokerage or its investors, wherein the program 
comprises one or more sequences of instructions that cause one or more processors to perform 
the steps of: 

receiving data from at least one source, wherein the received data comprises 
representative of: 

a plurality of transactions relating to securities tradings and 

a plurality of entities involved in securities trading, 

wherein the plurality of transactions and the plurality of entities are not 

predetermined to be related; 

accessing a scenario library to identify a detection algorithm for identifying a behavior of 
interest comprising one or more sequence detection requirements that is indicative of a risk to a 
brokerage or its investors by identifying rapid switching of a first mutual fund for a second 
mutual fund, wherein one or more of the plurality of transactions is a solicited transaction 
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involving one or more customers of a securities brokerage and one or more securities 
representatives, wherein the solicited transaction is solicited by the securities representative, 
wherein proceeds associated with the switching are at least a percentage of a value of the first 
mutual fund ; 

applying the detection algorithm to identify common olomonto between a plurality of the 
transactions and a plurality of the entities in the received data to determine whether the common 
elements arc collectively indicative of the behavior of interest; 

determining whether one or more groups of the transactions and entities collectively 
satisfy at least one of the one or more of the sequence detection requirements; 

determining whether one or more relationships exist among the transactions and the 
entities that exhibit the common clement; and 

in response to one or more relationships existing among the transactions and the entities 
that exhibit the common clement groups of the transactions and entities collectively satisfying at 
least one of the one or more sequence detection requirements , generating an alert informing a 
user of the related transactions and entities that exhibit the common e l e m e nts one or more groups 
of the transactions and entities . 

72. (Previously Presented) The computer program of claim 7 1 , wherein the 
instructions further cause the one or more processors to perform one or more of the following on 
the plurality of transactions and the plurality of entities: 

sequence matching to identify sequences in one or more transactions and to relate the 
identified sequences to one or more of the entities in the received data; 
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• 

link analysis to establish connections between one or more transactions and entities in the 
received data; 

rule-based analysis to identify at least one of the transactions and entities based on rules 
specifying parameters and thresholds; 

outlier detection analysis to identify at least one of the transactions and entities outside of 
a defined statistical range; 

decision tree analysis; and 

detection processing using neural networks. 

73. (Currently Amended) The method of claim 42, wherein applying the detection algorithm 
to identify common elements determining whether one or more groups of the transactions and 
entities collectively satisfy at least one of the one or more of the sequence detection requirements 
comprises determining whether the common elements one or more groups of the transactions and 
entities are collectively indicative of a behavior that conflicts with one or more Securities 
Exchange Commission regulations. 

74. (Currently Amended) The method of claim 42, wherein applying the det e ction algorithm 
to identify common e l e m e nts determining whether one or more groups of the transactions and 
entities collectively satisfy at least one of the one or more of the sequence detection requirements 
comprises determining whether the common e lem e nts one or more groups of the transactions and 
entities are collectively indicative of a behavior that conflicts with one or more National 
Association of Securities Dealers regulations. 
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75. (Currently Amended) The method of claim 42, applying tho detection algorithm to 
identify common elements determining whether one or more groups of the transactions and 
entities collectively satisfy at least one of the one or more of the sequence detection requirements 
determining whether the common elements one or more groups of the transactions and entities 
are collectively indicative of an illegal financial activity. 

76. (Currently Amended) The method of claim 42, wherein applying the detection algor i thm 
to identify common el e ments determining whether one or more groups of the transactions and 
entities collectively satisfy at least one of the one or more of the sequence detection requirements 
comprises determining whether the common elements one or more groups of the transactions and 
entities are collectively indicative of a fraudulent financial activity. 

77. (Currently Amended) The method of claim 42, wherein: accessing a scenario library to 
id e ntify a detection algorithm for identifying a behavior of interest indicative of a risk to a 
brokerage or its investors comprises identifying rapid switching of a first mutual fund for a 
second mutual fund, wherein one or more of the plurality of transactions is a solicited transaction 
involving one or more customers of a securities brokerage and one or more securities 
representatives, wherein the solicited transaction is solicited by the securities representative, 
wherein proceeds associated with the switching are at least a percentage of a value of the first 
mutual fund. 

78. (Previously Presented) The method of claim 42, wherein: 
the behavior of interest comprises: 
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selling, by a customer of a securities brokerage, a first mutual fund within six 
months of purchasing the first mutual fund, and 

using proceeds from the selling to buy a second mutual fund; and 
one or more of the following is solicited by a securities representative: 

sale of the first mutual fund, and 

purchase of the second mutual fund. 

79. (Previously Presented) The method of claim 42, wherein generating an alert comprises 
generating an alert in response to the following: 

selling, by a customer of a securities brokerage, a first mutual fund wherein proceeds 
from selling are used to purchase a second mutual fund, wherein one or more of the selling and 
the purchase are solicited by a securities representative; 

proceeds from selling the first mutual fund are at least 510,000; 

a purchase price of the second mutual fund is at least $10,000; and 

the proceeds from selling the first mutual fund are at least a percentage of a value of the 
first mutual fund. 
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